Add a new field num_mapped_sgs to struct urb so that we have a place to
store the number of mapped entries and can also retain the original
value of entries in num_sgs.  Previously, usb_hcd_map_urb_for_dma()
would overwrite this with the number of mapped entries, which would
break dma_unmap_sg() because it requires the original number of entries.

This fixes warnings like the following when using USB storage devices:
 ------------[ cut here ]------------
 WARNING: at lib/dma-debug.c:902 check_unmap+0x4e4/0x695()
 ehci_hcd 0000:00:12.2: DMA-API: device driver frees DMA sg list with different entry count [map count=4] [unmap count=1]
 Modules linked in: ohci_hcd ehci_hcd
 Pid: 0, comm: kworker/0:1 Not tainted 3.2.0-rc2+ #319
 Call Trace:
  <IRQ>  [<ffffffff81036d3b>] warn_slowpath_common+0x80/0x98
  [<ffffffff81036de7>] warn_slowpath_fmt+0x41/0x43
  [<ffffffff811fa5ae>] check_unmap+0x4e4/0x695
  [<ffffffff8105e92c>] ? trace_hardirqs_off+0xd/0xf
  [<ffffffff8147208b>] ? _raw_spin_unlock_irqrestore+0x33/0x50
  [<ffffffff811fa84a>] debug_dma_unmap_sg+0xeb/0x117
  [<ffffffff8137b02f>] usb_hcd_unmap_urb_for_dma+0x71/0x188
  [<ffffffff8137b166>] unmap_urb_for_dma+0x20/0x22
  [<ffffffff8137b1c5>] usb_hcd_giveback_urb+0x5d/0xc0
  [<ffffffffa0000d02>] ehci_urb_done+0xf7/0x10c [ehci_hcd]
  [<ffffffffa0001140>] qh_completions+0x429/0x4bd [ehci_hcd]
  [<ffffffffa000340a>] ehci_work+0x95/0x9c0 [ehci_hcd]
  ...
 ---[ end trace f29ac88a5a48c580 ]---
 Mapped at:
  [<ffffffff811faac4>] debug_dma_map_sg+0x45/0x139
  [<ffffffff8137bc0b>] usb_hcd_map_urb_for_dma+0x22e/0x478
  [<ffffffff8137c494>] usb_hcd_submit_urb+0x63f/0x6fa
  [<ffffffff8137d01c>] usb_submit_urb+0x2c7/0x2de
  [<ffffffff8137dcd4>] usb_sg_wait+0x55/0x161
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Data read direct from device tree properties will be in the device
tree's native endianness (i.e., big-endian).

This patch uses of_property_read_u32() to read the bus-width
property in host byte order instead.
Signed-off-by: NDave Martin <dave.martin@linaro.org>
Acked-by: NPawel Moll <pawel.moll@arm.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Rework the locking and lifecycle management in the cdc-acm driver.
Instead of using a global mutex to prevent the 'acm' object from being
freed, use the tty_port kref to keep the device alive when either the
USB side or TTY side is still active.

This allows us to use the global mutex purely for protecting the
acm_table, while use acm->mutex to guard against disconnect during
TTY port activation and shutdown.

The USB-side kref is taken during port initialization in probe(), and
released at the end of disconnect(). The TTY-side kref is taken in
install() and released in cleanup(). On disconnect, tty_vhangup() is
called instead of tty_hangup() to ensure the TTY hangup processing is
completed before the USB device is taken down.

The TTY open and close handlers have been gutted and replaced with
tty_port_open() and tty_port_close() respectively. The driver-specific
code which used to be there was spread across install(), activate() and
shutdown().
Reported-by: NDave Jones <davej@redhat.com>
Cc: Alan Cox <alan@linux.intel.com>
Cc: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: NHavard Skinnemoen <hskinnemoen@google.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

PS3 EHCI HC errata fix 244.  The SCC EHCI HC will not correctly perform QH
reads that occur near or span a micro-frame boundry.  This is due to a problem
in the Nak Count Reload Control logic (EHCI Specification 1.0 Section 4.9.1).

The work-around for this problem is for the HC driver to set I=1 (inactive) for
QHs with H=1 (list head).
Signed-off-by: NGeoff Levand <geoff@infradead.org>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>

The EHCI USB controller of the Cell Super Companion Chip used in the PS3
will stop the root hub after all root hub ports are suspended.  When in
this condition the ehci-hcd handshake routine will return -ETIMEDOUT and
the USB runtime suspend sequence will fail.  The STS_HLT bit will not be
set, so inspection of the frame index is used to test for the condition.

Add a new routine handshake_for_broken_root_hub() that is called after
an unsuccessful -ETIMEDOUT handshake.  On PS3 handshake_for_broken_root_hub()
will test for the condition, and if found will return success to allow the
USB suspend to complete.  For all other platforms
handshake_for_broken_root_hub() will return -ETIMEDOUT
Signed-off-by: NGeoff Levand <geoff@infradead.org>
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>

PS3 EHCI HC errata fix 316 - The PS3 EHCI HC will reset its
internal INSNREGXX setup regs back to the chip default values
on Host Controller Reset (CMD_RESET) or Light Host Controller
Reset (CMD_LRESET).  The work-around for this is for the HC
driver to re-initialise these regs when ever the HC is reset.

Adds a new helper routine ps3_ehci_setup_insnreg() which is
called from ps3_ehci_hc_reset().
Signed-off-by: NGeoff Levand <geoff@infradead.org>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>

Remove the ehci_reset() call done in the ehci_run() routine of the
USB EHCI host controller driver and add an ehci_reset() call to the
probe processing of all EHCI platform drivers that do not already call
ehci_reset().

The call to ehci_reset() from ehci_run() was problematic for several
platform drivers, and unnecessary for others.  This change moves the
decision to call ehci_reset() at driver startup to the platform
driver code.
Signed-off-by: NGeoff Levand <geoff@infradead.org>
Acked-by: NAlan Stern <stern@rowland.harvard.edu>

This patch adds power management support such as suspend and resume
functions.
Signed-off-by: NJingoo Han <jg1.han@samsung.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch converts the drivers in drivers/usb/* to use the
module_platform_driver() macro which makes the code smaller and a bit
simpler.

Cc: Felipe Balbi <balbi@ti.com>
Cc: Li Yang <leoli@freescale.com>
Cc: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Cc: Sarah Sharp <sarah.a.sharp@linux.intel.com>
Cc: Jiri Kosina <jkosina@suse.cz>
Cc: Lucas De Marchi <lucas.demarchi@profusion.mobi>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: NAxel Lin <axel.lin@gmail.com>
Acked-by: NPeter Korsgaard <jacmet@sunsite.dk>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This fixes a memory leak reported by Catalin Marinas:

schedule_ptds() is called from isp1760_irq() and removes the qh from the
controlqhs queue but ep->hcpriv still points to the qh and therefore it is not
freed.

Shortly after this, the isp1760_endpoint_disable() function sets ep->hcpriv to
NULL and calls schedule_ptds() but since the corresponding qh is no longer in
the queue, it is simply forgotten and reported by kmemleak.

With this patch, the qh is always freed at endpoint_disable, instead, and the
corresponding entry removed from the queue head list.

While I was at it, I also replaced the lines in isp1760_endpoint_disable()
that removed remaining qtds from the qh with a WARN_ON check for non-empty qh,
in line with earlier comments from Alan Stern (linux-usb list, 2011-07-20).
Signed-off-by: NArvid Brodin <arvid.brodin@enea.com>
Tested-by: NCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Small code refactoring to ease the real fix in patch #2.
Signed-off-by: NArvid Brodin <arvid.brodin@enea.com>
Tested-by: NCatalin Marinas <catalin.marinas@arm.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

xhci-hub used some numerical values for initialisation of root hub
descriptors. #define values are addded in usb 2.0 hub specification
file and these values are used for root hub characteristics
initialisation.

Also use some #defines in places where magic numbers are being used.
Signed-off-by: NAman Deep <amandeep3986@gmail.com>
Acked-by: NSarah Sharp <sarah.a.sharp@linux.intel.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

For OTG controller, the host driver will call function
otg_get_transceiver to get the otg transceiver, so we need to init the
OTG driver before HOST.
Signed-off-by: NNeil Zhang <zhangwm@marvell.com>
Acked-by: NFelipe Balbi <balbi@ti.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

  Handle null old_termios in ftdi_set_termios() calls from uart_resume_port().
Signed-off-by: NAndrew Worsley <amworsley@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The BKL is a gonner.
Signed-off-by: NDavidlohr Bueso <dave@gnu.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix for ftdi_set_termios() glitching output

ftdi_set_termios() is constantly setting the baud rate, data bits and parity
unnecessarily on every call, . When called while characters are being
transmitted can cause the FTDI chip to corrupt the serial port bit stream
output by stalling the output half a bit during the output of a character.
Simple fix by skipping this setting if the baud rate/data bits/parity are
unchanged.
Signed-off-by: NAndrew Worsley <amworsley@gmail.com>
Cc: stable <stable@vger.kernel.org>
----

  I had a brief run with strace on the getty and it was doing ioctl()s on
  each call but it didn't look relavant to the problem. I think the issue is
  that XON/XOFF flow control was being implmented via hardware - for the ixoff
  to allow the user to use XON/XOFF to control output. Unfortunately it would
  send 3 Control URBs updating all of the settings after each piece of input

  I am trying to work around the issue of gmail messing with the tab/spacing
  by submitting via SMTP via gmail which I believe should fix the issue.

  The patch is against v3.2-rc2 and compiles - but no additional testing in
  this kernel has been done.

  Thanks

   Andrew
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Signed-off-by: NFerenc Wagner <wferi@niif.hu>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Problems with NVIDIA's OHCI host controllers persist.  After looking
carefully through the spec, I finally realized that when a controller
is reset it then automatically goes into a SUSPEND state in which it
is completely quiescent (no DMA and no IRQs) and from which it will
not awaken until the system puts it into the OPERATIONAL state.

Therefore there's no need to worry about controllers being in the
RESET state for extended periods, or remaining in the OPERATIONAL
state during system shutdown.  The proper action for device
initialization is to put the controller into the RESET state (if it's
not there already) and then to issue a software reset.  Similarly, the
proper action for device shutdown is simply to do a software reset.

This patch (as1499) implements such an approach.  It simplifies
initialization and shutdown, and allows the NVIDIA shutdown-quirk code
to be removed.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Tested-by: NAndre "Osku" Schmidt <andre.osku.schmidt@googlemail.com>
Tested-by: NArno Augustin <Arno.Augustin@web.de>
Cc: stable <stable@vger.kernel.org> [after tested in 3.2 for a while]
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch adds new PIDs for ZTE 3G modem, after we confirm it and tested.
Thanks for Dan's work at kernel option devier.
Signed-off-by: NAlvin.Zheng <zheng.zhijian@zte.com.cn>
Signed-off-by: Nwsalvin <wsalvin@yahoo.com.cn>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Fix compile error, HC_LENGTH now takes two parameters and ehci
needs to be passed as the first parameter.
Signed-off-by: NJayachandran C <jayachandranc@netlogicmicro.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use CONFIG_CPU_XLR instead of CONFIG_NLM_XLR, the NLM_XLR config
option is redundant and is being removed.
Signed-off-by: NJayachandran C <jayachandranc@netlogicmicro.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

The 16-MB global limit on memory used by usbfs isn't suitable for all
people.  It's a reasonable default, but there are applications
(especially for SuperSpeed devices) that need a lot more.

This patch (as1498) creates a writable module parameter for usbcore to
control the global limit.  The default is still 16 MB, but users can
change it at runtime, even after usbcore has been loaded.  As a
special case, setting the value to 0 is treated the same as the hard
limit of 2047 MB.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

For a long time people have complained about the limitations imposed
by usbfs.  URBs coming from userspace are not allowed to have transfer
buffers larger than a more-or-less arbitrary maximum.

While it is generally a good idea to avoid large transfer buffers
(because the data has to be bounced to/from a contiguous kernel-space
buffer), it's not the kernel's job to enforce such limits.  Programs
should be allowed to submit URBs as large as they like; if there isn't
sufficient contiguous memory available then the submission will fail
with a simple ENOMEM error.

On the other hand, we would like to prevent programs from submitting a
lot of small URBs and using up all the DMA-able kernel memory.  To
that end, this patch (as1497) replaces the old limits on individual
transfer buffers with a single global limit on the total amount of
memory in use by usbfs.  The global limit is set to 16 MB as a nice
compromise value: not too big, but large enough to hold about 300 ms
of data for high-speed transfers.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1496) unifies the error-return pathways of several
functions in the usbfs driver.  This is not a very important change by
itself; it merely prepares the way for the next patch in this series.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1502) removes the UTF8-to-UTF16 conversion routine in
the USB gadget library and replaces it with a call to the equivalent
function in the NLS library.

The only downside worth noting is that the NLS library routine
requires the output buffer to be 16-bit aligned.  This is always true
in the gadget code, because the output buffer is always a
usb_request buffer being used to send a string descriptor.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

This patch (as1500) removes all uses of the objectionable hcd->state
variable from the ohci-hcd family of drivers.  It is replaced by a
private ohci->rh_state field, just as in uhci-hcd and ehci-hcd.
Signed-off-by: NAlan Stern <stern@rowland.harvard.edu>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

We pull one byte (the MAC header) from the first fragment before the
fragment is actually appended. So the socket buffer length is 1, not 0.
Signed-off-by: NRémi Denis-Courmont <remi.denis-courmont@nokia.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>

Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>

Use usb_translate_errors() to map USB-specific errors to errors
appropriate for user space (ENOMEM, ENODEV and EIO) in write.

Currently almost all serial drivers simply forward error codes from the
stack (e.g. from usb_submit_urb()), but these codes often have
different meanings in user-space. Doing the mapping in usb-serial core
simplifies driver code and allows for more consistent error reporting.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Minor whitespace clean ups.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Forward errors from usb_submit_urb in open.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Remove code that was apparently copied from pl2303, disabled and then
never used.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Forward errors from usb_submit_urb in open.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Make sure we forward all error codes (e.g. ENOMEM) to USB serial core.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

All error messages from stack in open are being forwarded except for
one call to usb_submit_urb. Change this for consistency.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use usb_translate_errors() to map USB-specific errors to errors
appropriate for user space (ENOMEM, ENODEV and EIO) in open.

Currently almost all serial drivers simply forward error codes from the
stack (e.g. from usb_submit_urb()), but these codes often have
different meanings in user-space. Doing the mapping in usb-serial core
simplifies driver code and allows for more consistent error reporting.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Move usb_translate_errors from usb core to linux/usb.h as it is meant to
be accessed from drivers.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Add support for multiple read urbs to generic read implementation.

Use a static array of two read urbs for now which is enough to get a
50% throughput increase in one test setup.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Use generic open rather than calling usb_serial_submit_read_urb
directly.
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>

Reorder urb submission and simply kill interrupt urb should read-urb
submission fail (rather than calling close).
Signed-off-by: NJohan Hovold <jhovold@gmail.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@suse.de>